linux-kernel - Re: [Intel-wired-lan] [PATCH net-next] ice: access @pp through netmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20251218004033.GB15390@system.software.com>
Date: Thu, 18 Dec 2025 09:40:33 +0900
From: Byungchul Park <byungchul@...com>
To: "Loktionov, Aleksandr" <aleksandr.loktionov@...el.com>
Cc: Pavel Begunkov <asml.silence@...il.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"kuba@...nel.org" <kuba@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"kernel_team@...ynix.com" <kernel_team@...ynix.com>,
	"harry.yoo@...cle.com" <harry.yoo@...cle.com>,
	"david@...hat.com" <david@...hat.com>,
	"willy@...radead.org" <willy@...radead.org>,
	"toke@...hat.com" <toke@...hat.com>,
	"almasrymina@...gle.com" <almasrymina@...gle.com>,
	"Nguyen, Anthony L" <anthony.l.nguyen@...el.com>,
	"Kitszel, Przemyslaw" <przemyslaw.kitszel@...el.com>,
	"andrew+netdev@...n.ch" <andrew+netdev@...n.ch>,
	"davem@...emloft.net" <davem@...emloft.net>,
	"edumazet@...gle.com" <edumazet@...gle.com>,
	"pabeni@...hat.com" <pabeni@...hat.com>,
	"intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>
Subject: Re: [Intel-wired-lan] [PATCH net-next] ice: access @pp through
 netmem_desc instead of page

On Wed, Dec 17, 2025 at 02:34:14PM +0000, Loktionov, Aleksandr wrote:
> > -----Original Message-----
> > From: Pavel Begunkov <asml.silence@...il.com>
> > Sent: Wednesday, December 17, 2025 2:16 PM
> > To: Loktionov, Aleksandr <aleksandr.loktionov@...el.com>; Byungchul
> > Park <byungchul@...com>; netdev@...r.kernel.org; kuba@...nel.org
> > Cc: linux-kernel@...r.kernel.org; kernel_team@...ynix.com;
> > harry.yoo@...cle.com; david@...hat.com; willy@...radead.org;
> > toke@...hat.com; almasrymina@...gle.com; Nguyen, Anthony L
> > <anthony.l.nguyen@...el.com>; Kitszel, Przemyslaw
> > <przemyslaw.kitszel@...el.com>; andrew+netdev@...n.ch;
> > davem@...emloft.net; edumazet@...gle.com; pabeni@...hat.com; intel-
> > wired-lan@...ts.osuosl.org
> > Subject: Re: [Intel-wired-lan] [PATCH net-next] ice: access @pp
> > through netmem_desc instead of page
> >
> > On 12/17/25 11:46, Loktionov, Aleksandr wrote:
> > >
> > >
> > >> -----Original Message-----
> > >> From: Intel-wired-lan <intel-wired-lan-bounces@...osl.org> On
> > Behalf
> > >> Of Byungchul Park
> > >> Sent: Tuesday, December 16, 2025 5:07 AM
> > >> To: netdev@...r.kernel.org; kuba@...nel.org
> > >> Cc: linux-kernel@...r.kernel.org; kernel_team@...ynix.com;
> > >> harry.yoo@...cle.com; david@...hat.com; willy@...radead.org;
> > >> toke@...hat.com; asml.silence@...il.com; almasrymina@...gle.com;
> > >> Nguyen, Anthony L <anthony.l.nguyen@...el.com>; Kitszel, Przemyslaw
> > >> <przemyslaw.kitszel@...el.com>; andrew+netdev@...n.ch;
> > >> davem@...emloft.net; edumazet@...gle.com; pabeni@...hat.com; intel-
> > >> wired-lan@...ts.osuosl.org
> > >> Subject: [Intel-wired-lan] [PATCH net-next] ice: access @pp through
> > >> netmem_desc instead of page
> > >>
> > >> To eliminate the use of struct page in page pool, the page pool
> > users
> > >> should use netmem descriptor and APIs instead.
> > >>
> > >> Make ice driver access @pp through netmem_desc instead of page.
> > >>
> > > Please add test info: HW/ASIC + PF/VF/SR-IOV, kernel version/branch,
> > exact repro steps, before/after results (expected vs. observed).
> > >
> > >> Signed-off-by: Byungchul Park <byungchul@...com>
> > >> ---
> > >>   drivers/net/ethernet/intel/ice/ice_ethtool.c | 2 +-
> > >>   1 file changed, 1 insertion(+), 1 deletion(-)
> > >>
> > >> diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c
> > >> b/drivers/net/ethernet/intel/ice/ice_ethtool.c
> > >> index 969d4f8f9c02..ae8a4e35cb10 100644
> > >> --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
> > >> +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
> > >> @@ -1251,7 +1251,7 @@ static int ice_lbtest_receive_frames(struct
> > >> ice_rx_ring *rx_ring)
> > >>            rx_buf = &rx_ring->rx_fqes[i];
> > >>            page = __netmem_to_page(rx_buf->netmem);
> > >>            received_buf = page_address(page) + rx_buf->offset +
> > >> -                         page->pp->p.offset;
> > >> +                         pp_page_to_nmdesc(page)->pp->p.offset;
> > > If rx_buf->netmem is not backed by a page pool (e.g., fallback
> > allocation), pp will be NULL and this dereferences NULL.
> > > I think the loopback test runs in a controlled environment, but the
> > code must verify pp is valid before dereferencing.
> > > Isn't it?
> >
> > Considering "page->pp->p.offset" poking into the pool, if that can
> > happen it's a pre-existing problem, which should be fixed first.
> >
> > --
> > Pavel Begunkov
> 
> 
> Good day, Hi Byungchul, Pavel,

Hi,

> Thanks for pushing the driver toward netmem — I fully support removing direct struct page accesses from the networking stack.
> 
> Regarding this change in ice_lbtest_receive_frames():
> 
>         received_buf = page_address(page) + rx_buf->offset +
>                 pp_page_to_nmdesc(page)->pp->p.offset;
> 
> Pavel, you're right that if page->pp could be NULL, it's a pre-existing bug that should be fixed.
> However, looking at the loopback test path, I'm concerned this code doesn't handle non-page-pool allocations safely.
> 
> The netmem model explicitly allows for buffers that aren't page-pool backed.
> While the loopback test likely runs in a controlled environment, the code should verify pp is valid before dereferencing,
> or use the netmem helpers that handle this gracefully:

If it's true, yeah, it definitely should be fixed but in a separate
patch since it's a different issue.  Let's try with a follow-up patch on
top after :-)

>         struct netmem_desc *ndesc = __netmem_to_nmdesc(rx_buf->netmem);
>         void *addr = netmem_address(rx_buf->netmem);
>         struct page_pool *pp;
> 
>         if (!addr)
>                 continue; /* unreadable netmem */
> 
>         pp = __netmem_get_pp(ndesc);
>         received_buf = addr + rx_buf->offset + (pp ? pp->p.offset : 0);
> 
> Alternatively, guard the existing code with page_pool_page_is_pp(page) before calling pp_page_to_nmdesc().
> 
> This would complete the netmem conversion while fixing the unsafe dereference,
> aligning with Matthew's earlier suggestion to use descriptor/address accessors.

Pavel's opinion is that the current way is more appropriate.  Which one
should it go for?

> Also, please add test details to the commit message:

This patch is more like a cleaning patch rather than a performance one.
Please tell me in more detail if you have any test to ask me to perform
for some reasons.

> HW/ASIC (e.g., E810/E823)
> PF vs VF, SR-IOV configuration
> Kernel tree/commit (net-next @ <sha>)
> Repro steps: ethtool -t $dev offline
> Before/after behavior
> Happy to review v2 with these changes.

Thanks for the review comment!

	Byungchul

> Best regards,
> Alex